MacOS – How does the visible storage on a Time Machine disk work

findermacostime-machine

I've had a computer failure and had to replace my computer with a new one. I have a Time Machine backup that I want to use to restore a large number of files from, but I don't want to do a full system restore. My old setup was a little crufty, and the OS version is old, so I want a new, clean OS/Application install. I don't want to use the Assistant, because I want more fine grain control over the files I'm copying over. I know how to use the "Browse other disks" function buried in the Time Machine setup, but this is a pain.

My question is about what you see when you browse the disk in the Finder or the Terminal. It lists the backups by date and time stamp, along with a shortcut to "Latest". I know Time Machine making a complete copy each time it backs up. My understanding is that it's not copying the diff each time it runs, it's just recording a new copy of any files which have changed since the last backup (like a directory diff).

What then does the user actually see when the browse to a particular folder with a given timestamp? Is OSX representing the filesystem in such a way that these folders look like a point-in-time representation? Can I just treat them as such without having to use the stupid animated, kill-everything-else on screen, Time Machine program?

Best Answer

You can safely restore files using finder or the command line (rsync or other) if you want to avoid using the Time Machine animation.

The reason why needs explanation: Technically, the system uses hard links. So if you make three new files on the desktop named A, B and C and then make three backups. This is what happens:

  1. The first backup copies the new files to the correct location on the backup drive (in your user's home folder for the time specific snapshot - or /Volumes/Drive/Backups.backupdb/mac_name/2011-07-03-123456/Mac HD/Users/you/Desktop/A and B and C.
  2. The next backup detects that the file is unchanged and makes a hard link in the next backup interval desktop directory pointing to the original file on the first backup.
  3. Now modify file B and make a backup. There will be one copy of A, C - each with link count of three (three intervals have that version) and there will be two versions of B one version with link count of 1 and one version with link count of 2.

Now the file "exists" in both directories with a link count of 2. Any copy operation copies the correct bits to the new place, and if you deleted one copy (Time Machine prevents this with Access Control Lists) of file A it would decrement the link count on the file and remove it from the folder list where you deleted it.

Eventually when the link count of a file is 1 - deleting it deletes both the data and the entry for the file.

For your case - you could pick a time and copy whatever files you want as hard links don't cross volume boundaries and you'll end up with a non hard linked file with link count 1 where you put the file on your current disk.

You didn't ask, but be sure to use tmutil to clean up files on the Time Machine or the graphical interface. They understand link counts and work well. If you try to delete files manually (say dragging them to trash) - you are in for a bad time unless you are sneaky about it.

Related Question